Secrets overview

RestoreTrust uses secret metadata to point a project worker to a Kubernetes Secret in your cluster.

You enter a display name, secret type, description, and Kubernetes Secret name in the console. You put the sensitive values and expected keys in the Kubernetes Secret in each selected worker's job namespace.

Supported secret types

A source must use active source credential metadata of the same type. A schedule selects encryption metadata only when its artifact settings require it.

Add secret metadata

1. 1

   Create the Kubernetes Secret

   In the project worker's job namespace, create a Kubernetes Secret with the required keys. Use a DNS-compatible Kubernetes object name.

2. 2

   Register the metadata

   Open Secrets in the active project and choose Create. Select the correct type and enter the exact Kubernetes Secret name. Do not paste a credential or passphrase into description fields.

3. 3

   Use it in a resource

   Select source credentials while creating a source, or select backup encryption credentials while configuring a schedule. If multiple workers can run that schedule, create an equivalent Kubernetes Secret in each worker's job namespace.

Use least-privilege source accounts and dedicated validation decryption material. Avoid sharing credentials between unrelated projects.